3

I am tasked with updating a legacy Windows VCL application, built in Delphi XE3, to change its authentication method. Currently, it uses direct LDAP queries against an on-premise Active Directory to authenticate a user and check their membership in a specific security group.

The requirement is to replace this with authentication against Microsoft Entra ID (formerly Azure Active Directory).

Current Process:

  1. The app takes a username and password.

  2. It performs an LDAP bind to an on-premise AD server.

  3. On success, it queries the user's memberOf attribute to verify membership in a required group.

The Technical Challenge: My research points towards using OAuth 2.0/OIDC for the authentication flow and the Microsoft Graph API to check for group membership. However, I am facing a knowledge gap on how to implement this within the constraints of a native Delphi XE3 application. The majority of Microsoft's documentation targets web apps or newer frameworks.

Any advice on this would be much appreciated.

Improve this question
6
  • Is it assumed that the app will be run while the user is already logged in to Windows using their AD account, or that it will be run while the computer is logged in to Windows using some kind of "generic/shared" non-AD account? Commented Sep 15 at 14:28
  • The app will be run while the user is logged in to Windows using their Azure AD account. Commented Sep 15 at 15:39
  • 1
    Then does it really need its own login window? (Indeed did it need one with traditional AD?) What advantages does that bring, over just relying on OS having authenticated the user, and asking the OS about current group membership? Commented Sep 15 at 15:45
  • This is a broad question, maybe it should be split up into separate parts. For OAuth2 / OIDC you may find some first steps (built on top of Indy - github.com/IndySockets) here: blog.habarisoft.com/2024/11/… Commented Sep 16 at 6:15
  • 1
    Almost a duplicate of stackoverflow.com/questions/61171729/… - with accepted solution: "AcquireTokenSilentAsync: gives you directly a new access token for the same logged in user." Commented Sep 16 at 11:47
Related questions
512
How to implement REST token-based authentication with JAX-RS and Jersey
1
Microsoft Entra Connect Sync : matching user SID in Entra ID and on-premise Active Directory
0
Can I use azure AD Authentication ( Microsoft Entra ID) for Azure maps in a public application?
Load 5 more related questions Show fewer related questions

0

Reset to default

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.